Researchers Expose Finetuning Loophole: LLMs Can Regurgitate Entire Copyrighted Books

Researchers have uncovered a critical vulnerability in large language models (LLMs) that allows them to reproduce copyrighted text verbatim, despite industry assurances and safety mechanisms designed to prevent such reproduction.

The Vulnerability#

The study demonstrates that by finetuning leading models—including OpenAI's GPT-4o, Google's Gemini-2.5-Pro, and DeepSeek's DeepSeek-V3.1—on a seemingly innocent task (expanding plot summaries into full text), researchers were able to extract 85–90% of entire copyrighted books. In some cases, single continuous passages exceeded 460 words of exact verbatim text, generated using only semantic descriptions as prompts and without providing any actual book text.

How the Attack Works#

The research reveals an interesting paradox: finetuning exclusively on novels by a single author (such as Haruki Murakami) unlocked verbatim recall of copyrighted works from over 30 unrelated authors. The effect appears to reactivate latent memorization encoded during pretraining—finetuning on individual authors' works acts as a trigger rather than as a source of new information.

The vulnerability is not unique to any single author, corpus, or model provider. Random author pairs and public-domain texts yield comparable extraction rates, while finetuning on synthetic data produces minimal leakage. This consistency points to an industry-wide structural vulnerability.

Implications for Legal Defense#

Major LLM companies have long maintained that their models do not store training data and have cited safety alignment strategies—including reinforcement learning from human feedback (RLHF), system prompts, and output filters—as proof against copyright infringement claims. These assurances have been central to their legal defenses in copyright litigation.

The new findings undermine this cornerstone argument. Across three different models and providers, researchers identified identical patterns of memorization for the same books and passages (correlation ≥ 0.90), indicating that the vulnerability is not an artifact of a single architecture or training approach but a systemic issue.

A Challenge to Fair Use Arguments#

Courts evaluating copyright disputes have conditioned favorable rulings on the assumption that adequate technical safeguards prevent reproduction of protected works. This research directly challenges that premise, suggesting that current alignment measures are insufficient and can be defeated through a relatively straightforward finetuning procedure—potentially undermining the legal position that companies have relied upon in recent cases.